Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool

A malicious Google Chrome extension called MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh) has been revealed as a credential-stealing tool for MEXC API keys, with the extension having 29 downloads and still available on the Chrome Web Store as of writing.

It was first published on 1 September 2025 by a developer named “jorjortan142,” and it programmatically creates new MEXC API keys with withdrawal permissions, hides that permission in the UI, and exfiltrates the resulting API key and secret to a hardcoded Telegram bot controlled by the threat actor, according to Socket security researcher Kirill Boychenko.

The extension operates by injecting a content script when the user visits MEXC’s API management page, creating the key with full permissions and then spoofing the UI to imply withdrawal rights have been disabled, while actually transmitting the credentials to the Telegram bot via HTTPS POST. The researchers note the threat actor can then use the compromised browser session to execute trades and withdrawals, effectively draining wallets while the extension remains active.

It remains unclear who is behind the operation, though a referenced X handle named “jorjortan142” links to a Telegram bot and other promo channels. According to Boychenko, the attack uses the Chrome Web Store for delivery, the MEXC UI for execution, and Telegram for exfiltration, highlighting a high-risk, long-lived API-key theft vector.